feat(code-sources): one card per code source, consistent token variable

[qiansc]

• Settings show one card per code source: connection fields (custom Git only) and the global token with its expiry, saved with one button. User settings show personal tokens per source.
• Clearer wording: "Code sources" / "Code source tokens", "HTTPS username", host placeholders show the effective value.
• GitHub's environment token is now SOURCEGRAPH_GITHUB_TOKEN; SOURCEGRAPH_GIT_TOKEN is still read while it is unset (legacy_token_env).
• Credentials API gains move_to for retired kinds: the token is re-encrypted server-side for an empty target, then the old record is cleared.
• Startup moves repositories registered with a retired provider to its target; pinned hosts are unchanged.

Checks: bun run check, go test ./..., bun run build; settings pages verified in a headless browser with mocked APIs.

Made with Cursor